--- a/usr/src/uts/common/fs/nfs/nfs4_state.c	Tue Jul 18 03:46:46 2006 -0700
+++ b/usr/src/uts/common/fs/nfs/nfs4_state.c	Tue Jul 18 04:09:41 2006 -0700
@@ -973,6 +973,7 @@
 {
 	int ioflag;
 	int file_vers = NFS4_SS_VERSION;
+	size_t dirlen;
 	struct uio uio;
 	struct iovec iov[4];
 	char *dir;
@@ -981,11 +982,14 @@
 	nfs_client_id4 *cl_id4 = &(cp->nfs_client);
 
 	/* allow 2 extra bytes for '/' & NUL */
-	dir = kmem_alloc(strlen(dss_path) + strlen(NFS4_DSS_STATE_LEAF) + 2,
-	    KM_SLEEP);
+	dirlen = strlen(dss_path) + strlen(NFS4_DSS_STATE_LEAF) + 2;
+	dir = kmem_alloc(dirlen, KM_SLEEP);
 	(void) sprintf(dir, "%s/%s", dss_path, NFS4_DSS_STATE_LEAF);
 
-	if ((ss_pn = rfs4_ss_pnalloc(dir, leaf)) == NULL)
+	ss_pn = rfs4_ss_pnalloc(dir, leaf);
+	/* rfs4_ss_pnalloc takes its own copy */
+	kmem_free(dir, dirlen);
+	if (ss_pn == NULL)
 		return;
 
 	if (vn_open(ss_pn->pn, UIO_SYSSPACE, FCREAT|FWRITE, 0600, &vp,